Auto Isolate w/ PowerAutomate + Defender for Endpoint

Being able to automatically isolate a device from the network during a cyber incident can be beneficial, but how do you do that? With Microsoft Power Automate + Microsoft Defender for Endpoint!

[ZeroInDaHouse]

You can also do this now using Custom Detection rules in the Defender Portal. By using a kql query and Continuous (NRT) frequency gives you near realtime alerting and isolating of devices without needing a flow or Microsoft Sentinel to do so.

[yusufbuhari]

This should be the same with Playbook from the Microsoft SIEM